An event listening-based network element security linkage handling system

Abstract

The application discloses a kind of based on event listening network element security linkage handling system, belong to node security technical field.System includes integrated management module and cloud platform;Integrated management module passes through probe and bypass listening double channel acquisition core and ordinary network element reported event, after fusion, identify abnormal network element, call local preset script and quickly handle, and synchronously upload event to cloud platform, cloud platform includes preprocessing layer, layered reinforcement learning decision architecture, strategy analysis and arrangement module and security channel module;Preprocessing layer carries out to confrontation sample detection and integrated learning vote, generates global situation view;Layered reinforcement learning decision architecture formulates macroscopic handling target and is converted into atomic handling action sequence, and generates handling script by strategy analysis and arrangement, is pushed to integrated management module execution by security channel module and feedback;The application realizes edge fast response and cloud intelligent decision-making cooperation, reduces misplacement rate and artificial dependence.

Description

Technical Field

[0001] This invention relates to the field of node security technology, and in particular to a network element security linkage and response system based on event monitoring. Background Technology

[0002] As enterprises deepen their digital transformation, the number of network elements has surged, and the forms of security threats have become increasingly complex and diverse. Traditional network node security protection solutions typically adopt a single security product stacking model, lacking effective information sharing and collaborative linkage mechanisms between various security components. This results in low security incident response efficiency and fragmented handling actions. When network elements are subjected to security threats, existing solutions often rely on manual analysis of security logs and manual execution of handling operations, making it difficult to meet the requirements of the increasingly severe security situation in terms of response speed.

[0003] Because existing technologies employ a centralized decision-making architecture, all network element events must be uploaded to the cloud for processing. However, cloud processing capacity is limited by network bandwidth and computing resources. When a large number of network elements report events simultaneously, congestion and queuing delays can easily occur, leading to system response lag. Furthermore, due to the lack of autonomous analysis and rapid response capabilities on the network element side, identified known threats still require cloud instructions before action can be taken, resulting in an inability to quickly respond to known threats at the edge. The cloud-based intelligent model directly outputs decision actions without fully considering the uncertainty of action execution and the differences in network element environments, and lacks effective security safeguards, leading to a high rate of mishandling. Finally, because the system does not rationally layer threats according to their attributes, efficient collaboration between the edge and the cloud cannot be achieved, and a large number of threat events rely on manual intervention for analysis and confirmation, resulting in a high degree of human dependency.

[0004] To address this, we propose a network element security linkage and response system based on event monitoring. Summary of the Invention

[0005] The purpose of this invention is to provide a network element security linkage and response system based on event monitoring, which solves the problems of slow response, high false alarm rate and high dependence on manual intervention in the current network element security protection system.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a network element security linkage and response system based on event monitoring, comprising an integrated management module and a cloud platform; The integrated management module is deployed on the network element side. It collects reported events from core network elements and ordinary network elements and merges the reported events. It receives reported events from core network elements through probes and reported events from ordinary network elements through network bypass monitoring. After merging the reported events, it determines abnormal network elements based on the reported events. For abnormal network elements, it calls a local preset script to execute and uploads the reported events to the cloud platform. The cloud platform includes a preprocessing layer, a hierarchical reinforcement learning decision architecture, a policy parsing and orchestration module, and a secure channel module. After receiving the reported events uploaded by the integration management module, the preprocessing layer identifies and isolates maliciously tampered data, and the integration learning and voting unit performs a comprehensive threat assessment and generates a global security situation view. The hierarchical reinforcement learning decision architecture includes a high-level policy network and a low-level action network. The high-level policy network formulates macro-level action objectives, and the low-level action network transforms macro-level action objectives into a sequence of atomic action sequences. The strategy parsing and orchestration module maps atomic action sequences to atomic operation combinations, generates disposal scripts, and pushes them to the integration management module via the security channel module; The integrated management module executes the processing script and sends the execution results back to the cloud platform.

[0007] Furthermore, when the integration management module merges the events reported by core network elements and ordinary network elements, it first aligns the reported events based on the timestamps, then deduplicates them based on the unique identifiers of the reported events, and generates an event association diagram based on the reported event type, source IP, and destination port to identify the same reported event across channels.

[0008] Furthermore, the step of identifying abnormal network elements based on reported events and performing correlation analysis on the reported events involves calling the local threat intelligence database and the network element behavior baseline model, calculating the confidence level of the fused reported events, marking network elements with a confidence level greater than a preset threshold as abnormal network elements, and generating an abnormal event chain.

[0009] Furthermore, the local pre-configured scripts include: port reset scripts, configuration repair scripts, service restart scripts, and backup connection switching scripts. The integrated management module matches the corresponding local pre-configured scripts based on common network element anomalies.

[0010] Furthermore, the adversarial example detection unit employs an adversarial autoencoder to calculate the reconstruction error of the input reported events. When the reconstruction error exceeds a preset threshold, it is determined to be malicious data tampering and isolated.

[0011] Furthermore, the integrated learning voting unit includes multiple base classifiers, each of which outputs a threat category probability. A comprehensive threat determination result is obtained through soft voting or hard voting, and a global security situation view is generated based on the comprehensive threat determination result of all network elements.

[0012] Furthermore, the high-level policy network formulates macro-level action objectives based on a global security situation view, and the low-level action network transforms the macro-level action objectives into atomic action sequences. The hierarchical reinforcement learning decision architecture adopts a two-stage training framework that combines offline pre-training and online fine-tuning. In the offline stage, the initial convergence of the policy network is completed in a high-fidelity digital twin simulation environment. In the online stage, a proximal policy optimization algorithm is used for progressive updates, and the policy change amplitude of each update is constrained to within a preset threshold by KL divergence.

[0013] Furthermore, the output of the hierarchical reinforcement learning decision architecture is equipped with a Q-value safety barrier. The Q-value safety barrier uses Monte Carlo Dropout to quantify the uncertainty of each candidate atomic action output by the low-level action network and calculates the confidence interval of the Q-value. When the confidence interval width of the candidate atomic action with the highest Q-value exceeds a preset threshold, or when the Q-value of the candidate atomic action with the highest Q-value deviates from the mean of historical action Q-values ​​under the current input state by more than a preset standard deviation multiple, interception is triggered, the decision is downgraded to a suggestion state and transferred to manual review. The intercepted decision and the manual review result are recorded as experience samples, stored in the corrective experience replay pool, and a state and action matching cache is established. This cache is used to lower the Q-value of the intercepted action and raise the Q-value of the manually corrected action during subsequent model fine-tuning.

[0014] Furthermore, the corrective experience replay pool stores manually reviewed and corrected experience samples using a priority experience replay strategy. During the online fine-tuning phase of the model, experience samples are sampled first for training. The state and action matching cache first extracts the core state features of the intercepted decision and encodes them into a core state feature vector, which is then bound to the manually corrected action. When a similar state feature is encountered again, the cache is hit first and the decision is directly output, so as to enable the model to make autonomous decisions and pass the Q-value safety barrier verification.

[0015] Furthermore, the secure channel module includes a two-way encrypted authentication channel, which uses asymmetric encryption and digital signatures to protect the integrity of the handling script. After receiving the handling script, the integrated management module first verifies the digital signature, then parses the atomic operation combinations in the script and executes them one by one. The execution result is fed back to the cloud platform through the secure channel module, and the cloud platform updates the global security situation view based on the execution result.

[0016] Compared with the prior art, the beneficial effects of the present invention are: This invention proposes a network element security linkage response system based on event monitoring. In existing technologies, network element security protection systems suffer from slow response, high false alarm rates, and high reliance on manual intervention. However, this invention, through a collaborative architecture integrating a management module and a cloud platform, enables multi-source event fusion and rapid handling via locally pre-built scripts on the network element side. The cloud platform, relying on adversarial sample detection, integrated learning voting, and hierarchical reinforcement learning decision-making architecture, achieves intelligent decision-making for complex threats. Q-value security barriers ensure decision security, ultimately forming a linkage response system of "rapid response on the network element side—intelligent decision-making on the cloud side—secure transmission through a secure channel." This significantly improves system response efficiency and handling accuracy while reducing reliance on manual intervention. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the overall architecture of the network element security linkage and response system based on event monitoring according to the present invention; Figure 2 This is a schematic diagram of the dual-channel event acquisition and fusion processing flow of the integrated management module of the present invention; Figure 3 This is a schematic diagram illustrating the event correlation graph generation and abnormal network element identification of the present invention; Figure 4 This is a schematic diagram of the rapid processing flow of the local pre-set script of the present invention; Figure 5 This is a schematic diagram of the data cleaning and threat assessment process in the cloud platform preprocessing layer of this invention; Figure 6 This is a schematic diagram illustrating the process of generating atomic action sequences using the hierarchical reinforcement learning decision architecture of this invention. Figure 7 This is a closed-loop schematic diagram of the Q-value safety railing and manual review feedback model of the present invention; Figure 8 This is a schematic diagram illustrating the closed loop of script generation, secure channel distribution, network element execution, and feedback in this invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] To address the technical challenges of improving the response efficiency and decision-making accuracy of network element security linkage response systems, such as... Figures 1-8 As shown, the following preferred technical solutions are provided: A network element security linkage and response system based on event monitoring includes an integrated management module and a cloud platform: The integrated management module is deployed on the network element side, collecting and fusing events reported by core network elements and ordinary network elements. The module receives these events through two channels: for core network elements such as servers, storage, network devices, and important workstations, real-time event collection is performed by deploying probe agents. These probes use eBPF technology to non-intrusively capture events such as system calls, network connections, and file operations. For ordinary network elements such as office PCs and IoT devices, network traffic is captured on the switch's mirror port through network bypass monitoring, and security-related events are extracted. These two channels complement each other, providing core network elements with deep event collection capabilities and enabling non-intrusive deployment for ordinary network elements, thus reducing performance overhead.

[0020] When the integrated management module merges events reported by core network elements and ordinary network elements, it first aligns the timestamps of the reported events and corrects for clock deviations, keeping the global clock error synchronized via the NTP protocol within 50ms. Then, it deduplicates the reported events based on their unique identifiers, which are generated by combining the network element ID, event type hash, and time window, ensuring that only one copy of the same reported event is retained when reported across multiple channels. Furthermore, it generates an event association graph based on the reported event type, source IP, and destination port to identify the same reported event across channels. When generating the event association graph, the integrated management module uses a graph relationship reasoning method within a sliding time window, with a 5-minute time window. All events within the window are treated as nodes, and the temporal relationship between events and the session relationship between IPs / ports are used as edges to construct a directed acyclic graph. A graph attention mechanism is then used to calculate the probability of abnormal propagation for each reported event node.

[0021] The integrated management module identifies abnormal network elements based on reported events and performs correlation analysis on the reported events: it calls the local threat intelligence database and the network element behavior baseline model to calculate the confidence level of the fused reported events, marks network elements with a confidence level greater than a preset threshold as abnormal network elements, and generates an abnormal event chain; the confidence level calculation formula is: ,in, and For the weighting coefficients, take respectively , Network elements with a confidence level greater than a preset threshold are marked as abnormal network elements, and an abnormal event chain is generated. The preset threshold is set to 0.75, which is a common balance point between the accuracy and sensitivity of security detection. The local threat intelligence database stores known malicious IPs, malicious domains, malicious file hashes, and other IOC information. The network element behavior baseline model is built based on the normal operation data of the network element over the past 30 days, covering process whitelists, network connection whitelists, CPU / memory utilization benchmark ranges, etc. When the reported event hits the threat intelligence database or deviates significantly from the behavior baseline, the confidence level rises rapidly.

[0022] For abnormal network elements, the integration management module first attempts to quickly handle the situation by calling locally pre-configured scripts. These locally pre-configured scripts include: a port reset script to close abnormally open ports, a configuration repair script to restore tampered system configuration files, a service restart script to restart critical services that have exited abnormally, and a backup connection switching script to switch services to a backup network channel. The integration management module matches the corresponding locally pre-configured scripts based on the common anomalies of the network element: if the anomaly type is malicious port opening, a port reset script is matched; if the anomaly type is critical service stopping, a service restart script is matched; if the anomaly type is network connection anomaly, a backup connection switching script is matched. The response time of the locally pre-configured scripts is controlled within 200ms to meet real-time requirements.

[0023] Meanwhile, the integrated management module will upload the collected reported events, including the original reported events and the merged reported events, to the cloud platform through an encrypted channel for in-depth analysis and global decision-making.

[0024] The cloud platform includes: Preprocessing layer, used for: The preprocessing layer includes an adversarial example detection unit and an ensemble learning voting unit. After receiving reported events from the ensemble management module, the preprocessing layer first uses the adversarial example detection unit to identify and isolate maliciously tampered data. The adversarial example detection unit employs an adversarial autoencoder, which is unsupervised pre-trained on massive amounts of normal network element event data to learn the data distribution manifold of normal events. It then calculates the reconstruction error of the input reported events, using the mean squared error (MSE) as a metric. The calculation formula is as follows: ,in The original input data, To reconstruct data for the autoencoder, For data dimensions; the reconstruction error of normal events is low, while the reconstruction error of maliciously tampered data is significantly increased due to deviation from the normal data distribution. When the reconstruction error exceeds the preset threshold, it is judged as malicious data tampering and isolated to prevent attackers from misleading the cloud platform's decision-making by constructing adversarial examples. The network structure of the adversarial autoencoder adopts a symmetrical encoder-decoder design. The encoder consists of 3 fully connected network layers with 256-128-64 neurons in each layer, using the ReLU activation function and batch normalization layer. The decoder has a symmetrical 64-128-256 structure.

[0025] After being cleaned by the adversarial example detection unit, the reported events are sent to the ensemble learning voting unit. This unit includes multiple base classifiers, specifically deep neural network-based classifiers, XGBoost-based classifiers, and graph neural network-based association classifiers. Each base classifier outputs a threat category probability, such as ransomware, cryptomining malware, APT penetration, or normal. A comprehensive threat assessment result is obtained through soft voting (averaging the probabilities output by each base classifier) ​​or hard voting (majority vote). Compared to a single model, the ensemble learning voting unit has higher threat detection accuracy. Based on the comprehensive threat assessment result of all network elements, the preprocessing layer generates a global security posture view, which displays various assets from an asset perspective. Key information such as the security status of network elements, threat type distribution, and attack chain stages provides decision-making input for high-level policy networks. Multiple base classifiers of the integrated learning voting unit adopt a differentiated training strategy: the deep neural network classifier is trained on the global dataset, the XGBoost classifier is trained on the statistical feature set after feature engineering, and the graph neural network classifier is specifically trained on event association graph structure data. The three complement each other. In the soft voting process, a dynamic weight mechanism is introduced to adjust the voting weight in real time according to the prediction accuracy of each base classifier for verified events in the past hour. The base classifier with higher accuracy receives higher voting weight. The real-time sliding window calculation cycle of accuracy is updated once every 100 prediction samples.

[0026] A hierarchical reinforcement learning decision architecture includes: The system consists of a high-level policy network and a low-level action network. The high-level policy network formulates macro-level action targets based on a global security situation view. These macro-level action targets are high-level action instructions, including but not limited to: isolating target network elements from the network, terminating specific malicious processes, blocking network communication of specific IPs or ports, modifying system security configurations to enhance defense levels, and triggering emergency backups of critical data. The high-level policy network adopts a deep Q-network architecture. The input is the global security situation view generated by the preprocessing layer, and the output is the Q-value of each macro-level action target. The macro-level action target with the highest Q-value is selected as the current decision.

[0027] The low-level action network transforms macro-level processing targets into atomic processing action sequences. An atomic processing action is the smallest executable operation unit, including but not limited to: calling a system API to terminate a process (PID), writing iptables rules to block an IP, modifying the registry or configuration file, restarting a system service, triggering a data replication task, etc. The low-level action network adopts a Transformer-based sequence generation model to encode macro-level processing targets into conditional vectors and generate corresponding atomic processing action sequences through autoregression.

[0028] The hierarchical reinforcement learning decision architecture adopts a two-stage training framework combining offline pre-training and online fine-tuning. In the offline stage, the policy network is initially converged in a high-fidelity digital twin simulation environment. The simulation environment simulates an enterprise network with 5,000 network element nodes and includes more than 40 common attack scenarios, such as ransomware propagation, worm scanning, and brute-force attacks. The policy network is pre-trained by accumulating more than 1 million steps of experience data through interaction with the simulation environment. In the online stage, a proximal policy optimization algorithm is used for incremental updates. The policy change magnitude of each update is constrained within a preset threshold (KL≤0.02) by KL divergence to prevent policy mutations from causing a sharp decline in decision quality.

[0029] The output of the hierarchical reinforcement learning decision architecture is equipped with a Q-value safety barrier as the last line of defense for decision security. The Q-value safety barrier uses Monte Carlo Dropout to quantify the uncertainty of each candidate atomic action output by the low-level action network. Specifically, the Dropout layer is kept active during the inference phase, and T random forward propagations are performed on the same input, with T being 30 times, to obtain the empirical distribution of the Q-value. The confidence interval of the Q-value (95% confidence level) is calculated. Interception is triggered when one of the following situations occurs: (1) The confidence interval width of the candidate atomic action with the highest Q-value exceeds the preset threshold; for example, exceeding 30% of the mean Q-value, indicating that the model is highly uncertain about the decision; (2) The Q-value of the candidate atomic action with the highest Q-value deviates from the mean Q-value of historical actions under the current input state by more than the preset standard deviation multiple; for example, 3 times the standard deviation, indicating that the decision is statistically an outlier. After triggering the interception, the decision is downgraded to a suggestion state and transferred to manual review.

[0030] Intercepted decisions and manual review results are recorded as experience samples, stored in a corrective experience replay pool, and a state-action matching cache is established. The corrective experience replay pool stores manually reviewed and corrected experience samples using a priority experience replay strategy. Intercepted experience samples are assigned a higher sampling priority: the sampling weight is 3 times that of ordinary samples. During the online fine-tuning phase of the model, experience samples are prioritized for training. Specifically, in each training batch, 50% of the samples come from the corrective experience replay pool and 50% come from the regular experience replay pool. This is used to lower the Q-value of intercepted actions and raise the Q-value of manually corrected actions during subsequent model fine-tuning. The state-action matching cache first extracts the core state features of the intercepted decision, encodes the core state features into core state feature vectors, and then binds them to manually corrected actions. When a new network element abnormal state is encountered, the system extracts the core state features of the current abnormal state and encodes them into core state feature vectors. The cosine similarity is calculated one by one with the core state feature vectors of each historical record in the cache, and the maximum similarity value is taken as the matching basis. If the maximum cosine similarity is greater than 1, the system will use the maximum cosine similarity value as the matching basis. If the maximum cosine similarity is 0.85, the current abnormal state is determined to have similar state characteristics to historical abnormal states. The system extracts manually corrective actions bound to the historical abnormal states from the cache and uses these actions as candidate actions. The system then performs a consistency check between the current target network element's network element type, service level, operating status, and operation permissions and the corresponding conditions in the historical experience samples. If the consistency check passes, the candidate actions are input into the strategy parsing and orchestration module for precondition, dependency, and mutual exclusion checks. If the checks pass, a disposal script is generated. If the consistency check fails or there are unresolved operational conflicts, the system stops reusing the manually corrective actions and enters the complete decision-making process on the cloud platform. If the maximum cosine similarity is less than or equal to 0.85, it is determined to be a dissimilar state characteristic. The system then enters the complete decision-making process on the cloud platform, generating a disposal decision after preprocessing layer analysis, hierarchical reinforcement learning decision architecture reasoning, and Q-value security guardrail verification. After successful execution, the disposal decision is stored in the cache as a new experience record to enrich the knowledge base for subsequent matching. The 0.85 threshold was determined based on experimental verification in the feature space of typical security scenarios, which effectively avoids mismatches in different scenarios while ensuring cache hit rate.

[0031] The strategy parsing and orchestration module is used for: The atomic action sequence output by the low-level action network is mapped to atomic operation combinations to generate executable handling scripts. Specifically, the strategy parsing and orchestration module has a built-in atomic operation library. Each atomic operation includes an operation identifier, execution parameter template, applicable network element type, preconditions, dependent operations, mutually exclusive operations, handling level, expected state, and rollback operation. Each atomic action in the atomic action sequence is mapped to the corresponding atomic operation by querying the atomic operation library. The strategy parsing and orchestration module matches the preconditions of each atomic operation according to the current state of the target network element and determines the execution order according to dependent operations. When two atomic operations are mutually exclusive, the threat reduction priority, business impact level, and reversibility of the two atomic operations are compared. The atomic operation with higher priority and smaller business impact is retained. Conflicting operations that cannot be automatically resolved are marked as pending review operations. After manual confirmation, they are added to or removed from the handling script. Subsequently, atomic operations are grouped and orchestrated according to the handling levels of risk suppression, threat isolation, malicious removal, and business recovery to generate handling scripts that include execution conditions, execution order, expected state, and rollback path.

[0032] The secure passage module is used for: The disposal script is pushed to the integration management module; the secure channel module includes a two-way encrypted authentication channel, which uses asymmetric encryption (national cryptographic SM2 algorithm) and digital signature to protect the integrity of the disposal script. The cloud platform uses its own private key to sign the disposal script, and the integration management module uses the cloud platform's public key to verify the signature, ensuring that the disposal script is from a trustworthy source and has not been tampered with during transmission.

[0033] After receiving the handling script, the integrated management module verifies the digital signature, parses the atomic operation combinations in the handling script, and executes them step by step according to the handling levels of risk suppression, threat isolation, malicious removal, and service recovery. Before executing the atomic operation of the current level, it checks the current status, operation permissions, and completion status of dependent operations of the target network element. If the preconditions are met, it executes the atomic operations of the current level sequentially and records the execution status and output logs of each step. After the current level is completed, it re-collects the number of abnormal events, abnormal connection status, and critical service operation status of the target network element. It compares the re-collected results with the status before execution to obtain the change in abnormal events and the change in network element service status. When the change in abnormal events reaches a certain threshold... When the threat suppression conditions corresponding to the current level are met and the change in network element service status is within the allowable range, the current level is confirmed to be effective, and the execution permission for the next level of atomic operation is granted. When the change in abnormal event status does not meet the threat suppression conditions, the system returns to the cloud platform to reselect atomic operations or upgrade the handling level. When the change in network element service status exceeds the allowable range, unexecuted atomic operations are stopped, and the rollback operations corresponding to the executed atomic operations are called in the reverse order of execution. When any atomic operation fails or exceeds the execution time limit, the failure position is recorded, the corresponding rollback operation is executed, and the execution failure information is fed back to the cloud platform. After all handling levels are completed, the integration management module will update the status of each atomic operation. The execution status, threat verification results, business status verification results, and rollback records are transmitted back to the cloud platform through the secure channel module. The cloud platform updates the global security posture view based on the feedback and re-inputs any tasks that do not meet the expected status into the hierarchical reinforcement learning decision architecture. For example, when the comprehensive threat assessment result indicates that a target network element has a malicious process and is continuously initiating abnormal connections to adjacent network elements, the policy parsing and orchestration module obtains atomic actions to restrict abnormal connections, save on-site data, terminate the malicious process, and restore business connections. The atomic operation library records that saving on-site data depends on the target process still being in a readable state; terminating the malicious process and saving on-site data are subject to execution order constraints; and restoring business connections... The connection depends on the termination of abnormal connections and the removal of malicious processes. Based on this, the policy parsing and orchestration module will include restricting abnormal connections and saving on-site data in the risk suppression phase, terminating malicious processes in the malicious removal phase, and restoring service connections in the service recovery phase. After the integration management module completes the risk suppression phase, it will reacquire the number of abnormal connections and the operating status of critical services of the target network element. If the number of abnormal connections decreases and critical services are normal, the malicious removal phase will continue. If abnormal connections still exist after the malicious process is terminated, service recovery will be suspended and a request will be made to the cloud platform to generate a handling action to improve the network isolation level. If the operating status of critical services is abnormal, the saved pre-execution configuration and connection status will be invoked to perform a rollback.

[0034] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A network element security linkage and response system based on event monitoring, characterized in that, Includes an integrated management module and a cloud platform; The integrated management module is deployed on the network element side. It collects reported events from core network elements and ordinary network elements and merges the reported events. It receives reported events from core network elements through probes and reported events from ordinary network elements through network bypass monitoring. After merging the reported events, it determines abnormal network elements based on the reported events. For abnormal network elements, it calls a local preset script to execute and uploads the reported events to the cloud platform. The cloud platform includes a preprocessing layer, a hierarchical reinforcement learning decision architecture, a policy parsing and orchestration module, and a secure channel module. After the preprocessing layer receives the reported events uploaded by the integration management module, the adversarial example detection unit identifies and isolates maliciously tampered data, and the integration learning voting unit performs a comprehensive threat assessment and generates a global security situation view. The hierarchical reinforcement learning decision architecture includes a high-level policy network and a low-level action network. The high-level policy network formulates macro-level action objectives, and the low-level action network transforms the macro-level action objectives into a sequence of atomic action sequences. The strategy parsing and orchestration module maps atomic action sequences to atomic operation combinations, generates disposal scripts, and pushes them to the integration management module via the security channel module; The integrated management module executes the processing script and sends the execution results back to the cloud platform.

2. The network element security linkage and response system based on event monitoring according to claim 1, characterized in that: When the integrated management module merges events reported by core network elements and ordinary network elements, it first aligns the reported events based on their timestamps, then deduplicates them based on their unique identifiers, and generates an event association diagram based on the event type, source IP, and destination port to identify the same reported event across channels.

3. The network element security linkage and response system based on event monitoring according to claim 1, characterized in that: The process involves identifying abnormal network elements based on reported events and performing correlation analysis on the reported events: calling the local threat intelligence database and the network element behavior baseline model, calculating the confidence level of the fused reported events, marking network elements with a confidence level greater than a preset threshold as abnormal network elements, and generating an abnormal event chain.

4. The network element security linkage and response system based on event monitoring according to claim 1, characterized in that: The local pre-configured scripts include: port reset script, configuration repair script, service restart script, and backup connection switching script. The integrated management module matches the corresponding local pre-configured scripts based on common network element anomalies.

5. The network element security linkage and response system based on event monitoring according to claim 1, characterized in that: The adversarial example detection unit employs an adversarial autoencoder to calculate the reconstruction error of the input reported events. When the reconstruction error exceeds a preset threshold, it is determined to be malicious data tampering and isolated.

6. The network element security linkage and response system based on event monitoring according to claim 1, characterized in that: The integrated learning voting unit includes multiple base classifiers, each of which outputs a threat category probability. A comprehensive threat determination result is obtained through soft voting or hard voting, and a global security situation view is generated based on the comprehensive threat determination result of all network elements.

7. The network element security linkage and response system based on event monitoring according to claim 1, characterized in that: The high-level policy network formulates macro-level action objectives based on a global security situation view, and the low-level action network transforms the macro-level action objectives into atomic action sequences. The hierarchical reinforcement learning decision architecture adopts a two-stage training framework that combines offline pre-training and online fine-tuning. In the offline stage, the initial convergence of the policy network is completed in a high-fidelity digital twin simulation environment. In the online stage, a proximal policy optimization algorithm is used for progressive updates, and the policy change amplitude of each update is constrained to within a preset threshold by KL divergence.

8. The network element security linkage and response system based on event monitoring according to claim 7, characterized in that: The hierarchical reinforcement learning decision architecture output is equipped with a Q-value safety barrier. The Q-value safety barrier uses Monte Carlo Dropout to quantify the uncertainty of each candidate atomic action output by the low-level action network and calculates the confidence interval of the Q-value. When the confidence interval width of the candidate atomic action with the highest Q-value exceeds a preset threshold, or when the Q-value of the candidate atomic action with the highest Q-value deviates from the mean of historical action Q-values ​​under the current input state by more than a preset standard deviation multiple, interception is triggered, the decision is downgraded to a suggestion state and transferred to manual review. The intercepted decision and the manual review result are recorded as experience samples, stored in the corrective experience replay pool, and a state-action matching cache is established. This cache is used to lower the Q-value of the intercepted action and raise the Q-value of the manually corrected action during subsequent model fine-tuning.

9. The network element security linkage and response system based on event monitoring according to claim 8, characterized in that: The corrective experience replay pool stores manually reviewed and corrected experience samples using a priority experience replay strategy. During the online fine-tuning phase of the model, experience samples are sampled first for training. The state and action matching cache first extracts the core state features of the intercepted decision and encodes them into a core state feature vector, which is then bound to the manually corrected action. When a similar state feature is encountered again, the cache is hit first and the decision is output directly, so as to enable the model to make autonomous decisions and pass the Q-value safety barrier verification.

10. The network element security linkage and response system based on event monitoring according to claim 1, characterized in that: The secure channel module includes a two-way encrypted authentication channel, which uses asymmetric encryption and digital signatures to protect the integrity of the handling script. After receiving the handling script, the integrated management module first verifies the digital signature, then parses the atomic operation combinations in the script and executes them one by one. The execution result is fed back to the cloud platform through the secure channel module, and the cloud platform updates the global security situation view based on the execution result.

Images